High · published October 15, 2025
⚡ When DNS cache is misconfigured on BIG-IP servers, sneaky queries can cause memory usage to spike like a balloon at a birthday party! 🎈 Think of it like a restaurant that keeps getting extra orders but never updates its kitchen staff—eventually, the cooks are overwhelmed, and service goes downhill fast! This vulnerability could lead to significant slowdowns or even crashes of your server, affecting all users as resources become scarce. If exploited, it could disrupt services, leaving your applications in a jam while they try to catch up. Don't let your server be the one that stumbles under pressure!
Think of it like a restaurant that keeps getting extra orders but never updates its kitchen staff—eventually, the cooks are overwhelmed, and service goes downhill fast! The issue arises when DNS queries are allowed to pile up on a BIG-IP or BIG-IP Next CNF virtual server, leading to increased memory consumption that can degrade performance over time.
This vulnerability could lead to significant slowdowns or even crashes of your server, affecting all users as resources become scarce. If exploited, it could disrupt services, leaving your applications in a jam while they try to catch up. Don't let your server be the one that stumbles under pressure! To mitigate this risk, review your DNS cache configuration on BIG-IP systems and ensure it’s optimized. Consider setting limits on memory usage and keep your software updated to avoid unsupported versions. Regular audits can help catch configuration issues early! You've got this! With a little attention, you can keep your server running smoothly! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| f5/big-ip_access_policy_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_advanced_firewall_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_advanced_web_application_firewall | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_analytics | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_application_acceleration_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_application_security_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_application_visibility_and_reporting | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_automation_toolchain | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_carrier-grade_nat | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_container_ingress_services | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_ddos_hybrid_defender | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_domain_name_system | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_edge_gateway | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_fraud_protection_service | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_global_traffic_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_link_controller | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_local_traffic_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_policy_enforcement_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_ssl_orchestrator | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_webaccelerator | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_websafe | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_access_policy_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_advanced_firewall_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_advanced_web_application_firewall | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_analytics | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_application_acceleration_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_application_security_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_application_visibility_and_reporting | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_automation_toolchain | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_carrier-grade_nat | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_container_ingress_services | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_ddos_hybrid_defender | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_domain_name_system | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_edge_gateway | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_fraud_protection_service | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_global_traffic_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_link_controller | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_local_traffic_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_policy_enforcement_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_ssl_orchestrator | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_webaccelerator | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_websafe | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_application_visibility_and_reporting | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_automation_toolchain | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_carrier-grade_nat | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_container_ingress_services | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_ddos_hybrid_defender | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_domain_name_system | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_edge_gateway | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_fraud_protection_service | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_global_traffic_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_link_controller | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_local_traffic_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_policy_enforcement_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_ssl_orchestrator | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_webaccelerator | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_websafe | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_access_policy_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_advanced_firewall_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_advanced_web_application_firewall | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_analytics | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_application_acceleration_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_application_security_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_next_cloud-native_network_functions | ≥ 1.1.0, ≤ 1.4.0 | — |